KernelScope: Paired Exploit/Benign Linux Kernel Telemetry Dataset

KernelScope is a reproducible dataset of paired exploit and benign telemetry captures for 18 documented Linux kernel CVEs (kernels 5.8–6.3), spanning heap and stack out-of-bounds write, use-after-free, double-free, type confusion, race/logic errors, eBPF-verifier flaws, netfilter/nftables, and privilege-escalation vulnerabilities. Each entry reproduces a real vulnerability against the affected kernel inside an isolated QEMU/KVM environment (via KernJC), recording live-streamed and post-run instrumentation: bpftrace counters and kernel-stack samples, ftrace function_graph, dmesg (crash-resilient), and perf (surviving VMs). Every cell includes an eBPF-derived flamegraph, and every surviving-VM cell additionally includes a perf flamegraph. The dataset uses a paired KASAN methodology: workloads are captured with KASAN enabled and disabled in otherwise-identical builds, enabling study of how memory-safety instrumentation affects exploit behavior and telemetry. Benign control variants idle and activity-matched baselines provide the negative class for exploit-vs-benign learning. Outcome labeling captures the full spectrum race_won (exploitation succeeded), race_lost (vulnerability triggered but exploitation failed valid hard negatives), and crash_confirmed (VM terminated; DoS-class) with every crash label backed by captured on-disk evidence (dmesg crash markers, KASAN reports). For DoS-class CVEs the exploit crashes the kernel; such cells carry crash evidence and live-streamed ftrace/bpftrace/eBPF up to termination in place of post-run perf, since perf is retrieved post-run and is conditional on VM survival. The eBPF layer streams during the run and therefore covers crash cells where perf structurally cannot. A duplicated complete CVE folder (SAMPLE_CVE_expected_structure/) illustrates the per-cell layout. Total: 255 exploit cells and 359 benign cells across 18 CVEs (kernels 5.8.7–6.3.1); ~49 GB uncompressed, ~2.7 GB compressed. For methodology, schema, and known limitations, see the included docs (DATASET_SUMMARY, KNOWN_LIMITATIONS) and cve-list.yaml.